Dolinethe threat model

The void was already there

A doline is a sinkhole — the point where the roof of a void that was already there stops holding. Nothing arrives from outside. The right way to name an insolvency is after the geometry that caused it rather than after the day it was noticed.

Read this first

The router works, and the vault is one you deploy yourself. Route runs against Base right now — real pools, real quotes, your transaction simulated and then swapped through Uniswap’s own SwapRouter02. The Aquifer vault and the Spar receipt are compiled, their properties are executed on an EVM by every build, and the panel on Aquifer puts them on chain from your own wallet in three transactions.

We have deployed no instance and there is no audit. Tested is not audited, and the gap between them is most of the risk — which is what the deposit cap is for. Set it to a number you would not mind losing. Whoever deploys a vault is its guardian, and a guardian can only Choke it and lower that cap.

There is no token. Every address field in the configuration is an empty string, and the build fails if a contract address, an invented social handle, or a canonical pointing at an unregistered host ever appears in the markup.

S-00the state table

What is running, what is compiled, and what is a sentence

A blanket disclaimer is easy to write and tells a reader nothing about which part to trust. Each row below says what the thing is, what state it is in, and how you would check it yourself.

Part	State	What it is	How to check
Route /app	live	Discovers every Uniswap V3 pool between two tokens on Base, prices every route at your size, attributes the cost to the hops, simulates the transaction against the current block, and swaps through Uniswap’s own SwapRouter02.	Open it. No key, no backend, no proxy — and tools/verify-swap.mjs executes the exact calldata against live Base state on every run.
The measurement /conduit	live	Real quotes for every pool the venue reports, at eleven sizes, with the block they were taken at and the executable size each one holds.	tools/scan-pools.mjs re-runs it; the live panel re-quotes from your own machine.
The aquifer model /aquifer	live	Conduit growth under transported dissolution kinetics, solved to a published flux residual, running in the browser in the hero.	tools/verify-model.mjs — fourteen checks including three negative controls.
Aquifer, the vault contracts/Aquifer.sol · /aquifer	deployable	ERC-4626 over a position, with a share price that is a mark rather than a counter, rounding that goes against the person leaving, an inflation-attack offset, a deposit cap that can only ever be lowered, and a Choke that cannot stop a withdrawal.	The panel on /aquifer deploys it from your own wallet in three transactions, and the page then deposits and withdraws against it. tools/verify-contracts.mjs executes its properties on an EVM and then breaks the vault seven ways to confirm the suite notices; tools/verify-deploy.mjs runs the exact deploy sequence against Base’s real USDC. NO INSTANCE IS DEPLOYED BY US and there is no audit — the cap is what an unaudited vault can honestly offer.
Spar, the receipt contracts/Aquifer.sol	deployable	The vault’s own share token — a plain transferable ERC-20, because a receipt that needs a second contract to move is not liquid.	Same suite. Not deployed.
Private batching	none	Order matching inside a window before anything reaches a pool.	Nothing is written. /app routes and prices; it is not private and says so on the page.
Resurgence	none	Tokenised equities and the two-clock problem.	Nothing is written, and the legal work is the long pole rather than the code.

live — it runs against the real chain now. deployable — the build executes its properties on an EVM and the site can put it on chain from your wallet; we have deployed no instance and there is no audit. none — a sentence, and nothing has been written.

S-01What would go wrong

designed

The void was already there

A position whose stated value has never been tested at size. Nothing arrives from outside; the roof stops holding.

Every Aquifer publishes the size at which its own exit moves one per cent, measured against the venue rather than modelled, and republishes it on a schedule rather than at launch.

built

The route that was never there

A quote sourced from a depth aggregate rather than from a route. It is correct about the total and wrong about the trade.

Quotes come from a simulated execution against the venue’s own quoter at the size asked for, never from a depth figure divided by anything.

designed

The operator

A privileged key that can move assets, whatever the documentation calls it.

Choke stops flow and cannot move a position. There is no function on the roadmap that can, and if one appears this line is the thing that should have been read first.

designed

The oracle that agrees with you

A redemption price read from a source that quotes the same thing it is pricing.

Redemption is computed from the position’s own reserves at the block, and the staleness of that read is published beside the number rather than assumed away.

now

The unaudited contract

Nothing here is deployed and nothing here has been audited. That is the current state and it is the most important line on this page.

Every address field in js/brand.js is empty, the site prints no contract, and the roadmap says which of the four instruments exist as prose and which as code.

S-02The emergency stop

Choke

A passage chokes when breakdown or sediment fills it. Flow stops; nothing is taken, and nothing is anywhere it was not already. An emergency stop that can move assets is not an emergency stop, it is a key.

Concretely: Choke can stop deposits, stop harvests and stop the router. It cannot move a position, cannot change a share price, and cannot mint. There is no upgrade path on the roadmap that adds a function which can, and if one appears, this paragraph is the thing that should have been read first. G1

S-03What the site itself guarantees

Guarantees that are checked, not stated

A guarantee in prose is worth nothing unless something fails when it is broken. These are enforced by tools/validate.mjs, which is the build gate, and the full list is generated onto Survey from the checker itself so the page cannot name a check that does not exist.

No contract address anywhere in the markup while brand.contractAddress is empty.
No social link the configuration does not set, and no twitter:site without an account — that tag does not merely link an account, it attributes the page to it.
No canonical, no og:image and no twitter:card while no host is registered, because a canonical that does not resolve breaks every link card while the site looks perfect in a browser.
No colour anywhere in css/ or js/ outside the generated block, including as an rgb() triple.
No data-fact left unfilled, and none naming a key that does not exist.